elasticsearch – Cannot send logs from Logstash to Elastic Search
I deployed ELK Stack to k8s by using helm. In the cluster, Elasticsearch, Kibana and Filebeat are running. I also configured Logstash to send Filebeat logs and logs from external resource.
My external resource is running in another server so I created logstash service as nodePort from 30123. Here is my values.yaml for logstash.
logstashConfig:
logstash.yml: |
http.host: 0.0.0.0
pipelines.yml: |
# This file is where you define your pipelines. You can define multiple.
# For more information on multiple pipelines, see the documentation:
# https://www.elastic.co/guide/en/logstash/current/multiple-pipelines.html
- pipeline.id: logstash
path.config: "/usr/share/logstash/pipeline/logstash.conf"
- pipeline.id: devopsdashboard
path.config: "/usr/share/logstash/pipeline/devopsdashboard.conf"
# log4j2.properties: |
# key = value
# Allows you to add any pipeline files in /usr/share/logstash/pipeline/
### ***warn*** there is a hardcoded logstash.conf in the image, override it first
logstashPipeline:
logstash.conf: |
input {
beats {
port => 5044
}
}
filter {
}
output {
elasticsearch {
index => "%{[@metadata][beat]}-%{+YYYY.MM.dd}"
hosts => [ "elasticsearch-master:9200" ]
}
}
devopsdashboard.conf: |
input {
tcp {
host => "0.0.0.0"
port => 30123
codec => "json_lines"
}
}
filter {
mutate {
remove_field => ["host", "port"]
}
}
output {
elasticsearch {
index => "logstash-%{+YYYY.MM.dd}"
hosts => [ "elasticsearch-master:9200" ]
}
}
When I want to create index on Kibana, I can see filebeat index but cannot see logstash. If curl to elastic inside of logstash pod, my index is created but if I try to send logs by tcp via logstash, nothing happens. Do you have any ideas that how I can send logs from logtash to elastic?
I tried a python script to send logs by tcp from my local and I received “400 Bad Request”. I do not know what I am doing wrong. Here is my python script.
import socket
import json
import logging
from datetime import datetime
import sys
print("starting to send data to Elastic search")
# Create TCP/IP socket
print("Creating TCP/IP socket")
sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
message = []
try:
# Connect to port where server is running
server_address = ('Cluster_IP', 30123)
sock.connect(server_address)
data = {'@test' : 'test1', '@message': 'python test message', '@tags': ['python', 'test']}
sock.sendall(json.dumps(data).encode())
print("Sent")
print(sock.recv(1024))
except socket.error as e:
sys.stderr.write(str(e))
finally:
sock.close()
Thanks a lot!
Read more here: Source link